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Abstract. We consider character sums determined by isogenics 
of elliptic curves over finite fields. We prove a congruence condi- 
tion for character sums attached to arbitrary cyclic isogenies, and 
produce explicit formulas for isogenies of degree m < 8. 



1. Introduction 

Let p > 3 be prime, and let h p denote the class number of Q(\/— p). 
Let hp be either or h p , as p is congruent to 1 or 3 modulo 4, respec- 
tively. A well-known consequence of Dirichlet's analytic class number 
formula is the following identity: 

In jl], a similar class number identity is proved, where the sum runs over 
the F p points of an elliptic curve, and the quadratic residue character 
is replaced by the cokernel character of a 2-isogeny of elliptic curves. 
More precisely: 

Let k be a field with char(/c) ^ 2, and let Ei/k be the elliptic curve: 

(2) E 1 :y 2 =x 3 + ax 2 + bx, 0, a 2 ^ 46, 
which has a fc-rational 2-isogeny given by 

(3) T(x , y)= (l±^±JJ^p 

\ X x z 

to the curve 

E 2 : x 3 - 2ax 2 + (a 2 - 46) x. 
For k — F p , define a character \ T on Ei by 



Xr{P) 



1 PEr(E 1 (¥ p )) 

-1 P^r(^(F p )) 
l 
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Then for any prime p > 3 of good reduction, the quantity 
(4) S TiP = {xp-a}Xr{P) 

P£E 2 (F P ) 
P^oo 

satisfies the congruence S T)P = (mod p). Furthermore, — -S TjP — h* 
is bounded in absolute value by a constant C T independent of p. The 
notation {x} denotes the lifting from ¥ p to Z which satisfies < {x} < 
(p — 1) for all x G F p . 

In this paper, we extend the study to isogenies of degree greater 
than 2. In Section 2, we deduce an exact sequence related to the 
isogeny formulas of Velu over finite fields. In Section 3 we generalize 
the character sum from [4J to higher degree isogenies, and prove a 
relation that transports character sums across a normalized isogeny. 
This generalizes the congruence property of S T)P . In Section 4, we 
apply the results to determine explicit formulas for families of isogenies 
of degree m < 8. 

2. Isogenies 

2.1. Velu's formula. If the kernel of a separable isogeny is finite 
with cardinality d, then is referred to as a <i-isogeny, and the isogeny 
is said to have degree d. It is known that if d is composite, then 
every d-isogeny can be decomposed into a composition of prime degree 
isogenies. For this reason, we mainly concern ourselves with prime 
degree isogenies. We let denote the dual isogeny to 0, which satisfies 
o = [d], o = [d\. Here [d] is the multiplication by d map. 

Let E be an elliptic curve defined over a field k. Given a finite 
A;-rational subgroup T < E, let E' denote the quotient EjT . Velu 
has given formulas [8J for both a Weierstrass equation for E', and a 
separable isogeny 0: E — )■ E' whose kernel is exactly J 7 . For a point 
P = (xp,yp) G E — J 7 , the formula is: 
(5) 

0(P) = lx P + (xp+q - xq), yp+ Yl (vp+q-vq)\- 

\ QeT-{oo} QeF-{oo} J 

2.2. Normalization. In this subsection, we fix a field k, not of charac- 
teristic 2 or 3. Let Ej k be an elliptic curve. We may write a Weierstrass 
equation for E in the form y 2 = x 3 + ax + b. Let E'/k be another el- 
liptic curve, and let 0: E — » E' be a separable isogeny defined over k. 
If the pullback of the invariant differential u/ of E' along is equal to 
the invariant differential u of E, then is said to be normalized. As 
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the space of differentials is one dimensional, we know (p*u>' = c^u, for 
some C0 G k* . If = 1, then <p*u' = u and <p is normalized. 

We collect a few results about normalized isogenies which we will 
need for the proof of Theorem [6j Gonzalez [1] noted some of these, 
but only included a proof of Proposition HI We include proofs for 
completeness. We believe that these results are well-known, but not 
all collected in one place in the literature. 

Lemma 1. Let E\/k, E 2 /k be elliptic curves, and let <pi : E\ — > E2 
and (p 2 : Ei — >■ E 2 be k-rational isogenies. Then c^+$ 2 = + c^. 

Proof. Let Ui denote the invariant differential of Ei. This is an im- 
mediate consequence of the fact that {(pi + <p 2 )*uj 2 = 4>X UJ 2 + 4>2 U 2 (0 
Thm. III. 5. 2]). Since <p*u 2 = c^.uji, we have c^ 1+( ^ 2 = + c^. □ 

Lemma 2. Let Eijk (i = 1,2,3) be elliptic curves, and let <p\ : Ei — > 
E 2 , (p 2 : E 2 — >■ E% be k-rational isogenies. Then c^o^ = c^c^. 

Proof. Let U{ denote the invariant differential of Ei. Then 

(02 0l)*W 3 = 0102^3 = 0l(c0 2 W 2 ) = CfaCfcUJx, 

and the result follows. □ 

Corollary 3. The composition of two normalized isogenies is normal- 
ized. 

Proposition 4. Let E\jk and E 2 /k be elliptic curves, and let (pi, 
<p 2 : Ei — > E 2 be normalized isogenies. Then <p\ = <p 2 . In other words, 
for any fixed Ei and E 2 , there exists at most one normalized isogeny 
Ei — y E 2 . 

Proof. We follow the proof given in pQ . Let (pi be the dual of (pi . Then 
we have two endomorphisms ip\ = (piO(pi and ip 2 = <piotp 2 of E\. Notice 
also that = ct = c^ 2 , as <pi and (p 2 are normalized. By Lemma 
[TJ we see c^.^ = 0. This means that the endomorphism ipi — ip 2 is 
constant, and therefore 0. So ipi = ip 2 , and likewise <pi = <p 2 . □ 

Proposition 5. Let E/k, Ei/k, E 2 /k be elliptic curves. Suppose 
(pi : E — Y Ex and (p 2 : E — )■ E 2 are normalized isogenies with the same 
kernel. Then Ei = E 2 and <pi = <p 2 . 

Proof. By Proposition 12.12 (and Remark 12.13) of [9], we know there 
is an isomorphism ip : Ei — > E 2 defined over k such that (p 2 = ip o (p 1 . 
By Lemma [2], = 1. As char(A;) { 6, we may assume our curves 
have Weierstrass equations of the form y 2 = x 3 + ax + b. Thus, this 
isomorphism ip must be of the form ip(x,y) = (u 2 x,u 3 y), for some 
u G k*. It is easy to see that c^ = u, hence we must have u = 1, and 
ip is the identity map. The result is now immediate. □ 
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Remark: For arbitrary characteristic, we must allow general Weier- 
strass equations of the form y 2 + a^xy + a 3 y = x 3 + a 2 x 2 + a 4 x + a 6 . In 
this case, a version of Proposition [5] is still true, but we must add the 
condition that both of the isogenies 0i and <ft 2 h x «i> a 2, and a 3 (mean- 
ing these coefficients are the same for all three curves). The isogeny 
given by Velu's formula has this property, so given any normalized 
isogeny 0, with kernel J 7 , if fixes a\, a 2 , and 03, then is equal to 
the isogeny given by Velu's formula. 

2.3. An exact sequence with Velu's isogeny. In this section, we 
consider elliptic curves over finite fields F q , q = pf , of characteristic 
p > 3. Let E\/¥ q be an elliptic curve, and suppose P G Ei(¥ q ) is 
a point of exact order m, where {q,m) = 1. Let Tp denote the m- 
isogeny Tp: E\ — )■ E 2 whose kernel is exactly (P), as given by Velu's 
formula. The subgroup Tp(Ei(¥ q )) < E 2 (¥ q ) determines an isogeny 
ip : E 2 — > E 3 , also given by Velu's formula. 

Theorem 6. The codomain of ip is exactly the curve E\. Moreover, 
ip(E 2 (¥ q )) = (P). Equivalently, we have the following exact sequence 
of abelian groups: 

{00} — (P) — E 1 (¥ q ) E 2 (¥ q ) JU (P) — {00} . 

Proof. We compare two isogenies, a and (3. Define a = iporp, and j3 = 
1 — 7Tq, where n q denotes the Frobenius endomorphism (x, y) i-> (x q , y q ). 
Both maps are separable. This is clear for a, as it is a composition 
of separable isogenies; (3 is known to be separable by [9j Prop. 2.29]. 
Moreover, they are both normalized. For a, this follows from Corollary 
[3] and the fact that Velu's formula provides a normalized isogeny. For 
(3, this follows from the fact ([6, III. 5. 5]) that (s + tTT q )*uj = su for 
any integers s,t E Z. These isogenies must therefore be equal by 
Proposition O Thus, the codomain of a (and hence ip) is the codomain 
of (3, which is E\. 

Let T = ip(E 2 (¥ q )). It remains only to show that J 7 = (P). Cer- 
tainly, we have the exact sequence 

{00} (P) E 1 (¥ q ) E 2 (¥ q ) ^7 {00} . 

As Ei and E 2 are isogenous, the middle two groups have the same 
cardinality, and so by exactness we must have j^T = m. Let be 
the isogeny on E 2 with kernel J 7 which is given by Velu's formula. 
Essentially repeating the argument of the previous paragraph (this time 
considering 1 — n q on E 2 ), we see that o -0 has codomain E 2 . Thus, 
both Tp o ip and o ip are normalized isogenies E 2 — > E 2 with kernel 
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E 2 (¥ q ). By Proposition m they must be the same. Hence Tp = 0, and 
saF=(P). □ 

3. A CHARACTER SUM DETERMINED BY AN ISOGENY 

We now extend some of the results of [I] (where P is always a point 
of order m — 2) to general m. Let E\/W q be an elliptic curve, and 
P G Ei(¥ q ) a point of exact order m, with (q, m) — 1. Let t p : Ei ^ E 2 
be the isogeny with kernel (P) given by Velu's formula. By Theorem 
El the quotient £J 2 (F g )/rp(-E'i(F ? )) is isomorphic to the cyclic group 
(P). Choose Q G E 2 (¥ q ) such that [Q] generates the quotient. When 
m is prime, we may take any Q G E 2 (¥ q ) — rp(Pi(F g )). Let ( = ( m 
be a primitive m-th root of unity. We define a character on E 2 (¥ q ), 
determined by t p and [Q\. 

Xp (R) = C, for R-jQe r P (E 1 (¥ q )). 
We define an associated character sum on the points of E 2 : 
(6) S P := Xp(R)xr. 

R€E 2 {¥ q ) 

Note that Sp depends on the choice of [Q]. However, as ip(E 2 (¥ q )) = 
(P), we may always make a "preferred" choice of [Q] such that ip(Q) = 
P. Under this convention, we will see that Sp depends only on P. 
In fact, Sp depends only on the cyclic subgroup (P), and not the 
particular generator. 

Theorem 7. Let ip: E 2 — » E% be the normalized isogeny with kernel 
Tp(Ei(¥ q )) given by Velu. Then 

m—1 

s P = J2c ] x HjQ) . 

3=1 

Moreover, if Q is chosen so that ip{Q) = P, then 

m—1 

Sp = Y ( 3x jP- 

3=1 

Note the right hand side is a character sum of the x-coordinates of 
points on Ei, while the left hand side is defined over points on E^- 

Proof. Let fp be the dual isogeny to Tp, so that fp o rp = [m] on E± 
and Tp o Tp = [m] on E 2 , where [m] is the multiplication by m map. 
Notice that if U = mR for some R G E 2 (¥ q ), then U = Tp(fp(R)), and 
hence U G r P (Ei(F p )). 
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We first examine when m = 2k is even. Let T = Tp(Ei(¥ q )). Then 
we have 

s P = x * + E ( E^ j + c^>iQ+« ) + E cw* 

Using Velu's formula (jSJ) (and noting £ fe = —1), we have 

fc-i / n 

S P = -x kQ + ^2(x R - x kQ+R ) + E ( E^ + (~ 3 ) x iQ+R 
ReT j=i \ReT 

fc-1 / 

= -Xf {k Q) + E E^ + (~ J ) x iQ+R 
j=i \ReT 

fc-i 

= -^(fco) + E^ J + E 

j=i ReT 

( \ 

E x jq+r - E x/? + E xr 



+E(c j '+c 



fc-i 



-^v(feQ) + E^ J + ^ 

i=i 



\ i?er /JeT ReT 

\ R^oo R^oo 

( \ 

x i>W) + E Xr 

\ R^oo / 



R^oo 

fc-1 fc-1 

= -xmq) + E^' + c _i )^M) + E^' + c') E 

j=i i=i i?er 

fc-1 

= -x^(kQ) - (C* + 1) Xr + E^ + C^^VCjO) 

fo— 1 m— 1 

= -^(fcQ) + E^ + C^WoQ) = E 

3=1 3=1 

The case when m is odd is proven similarly. This proves the first claim. 
The second claim follows immediately. □ 

4. LOW DEGREE ISOGENIES 

We now apply the results of Theorem [7] to specific low degree isoge- 
nies. Throughout this section we set q = p, so that ¥ q = ¥ p , with p 
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prime. In the sections that follow, we use parameterizations of elliptic 
curves with a point of exact order m < 8. Such parameterizations are 
well-known, and can be found in [2] or [3] for instance. For our pur- 
poses, we will use the parametrization given in [5] for the case m = 4, 
and the parametrizations found by Kubert in [3] for m = 3, 5 < m < 8. 
In principle these results could be extended to any value of m for which 
such parameterizations exist, e.g., when Xi(m) has genus 0. 

In each case, Ei/¥ p is an elliptic curve, P G Ei(¥ p ) has exact order 
m, Tp\ Ei — )■ E 2 is the isogeny given by Velu whose kernel is (P) , and 
Q G E 2 (¥ p ) is chosen so that [Q] generates E 2 {¥ p )/t p (E 1 (¥ p )). We 
always assume (p, m) — 1, and let ( 6 F p denote a primitive m-th root 
of unity. 

4.1. The case m = 2. When m — 2, Theorem [7] becomes 

If P is a point of order 2, then by a suitable change of variables we may 
assume that P = (0,0). As Q ^ rp(£ , 1 (F p )) = ker^, by Theorem [61 
we must have ip(Q) = P. So Sp = 0. This is an alternate way to show 
that S T>P , as defined in (J4J), satisfies S T , P = (mod p) when a = 0. 

4.2. The case m — 3. If P = (a,b), then we claim Sp = —a. This 
follows from Theorem [71 as Q must satisfy 3Q = oo. Thus, ip(2Q) = 
—il}(Q), and 

Notice that in this case Sp is independent of the choice of Q. 

It is well known that any elliptic curve over ¥ p with an F p -rational 
point P of order 3 is isomorphic to a curve of the form 

E 1 : y 2 + axy + (3y = x 3 , P = (0, 0) 

where a, (3 e ¥ p , a 3 (/3 3 - 27a) ^ 0. Since iff{Q) G {P, 2P} and 
2P = (0, -(3), we have S P = 0. 

4.3. The case m = 4. Let P = (a, 6), and write 2P = (c,d). By 
Theorem [7J (as 3Q = —Q), 

Sp = C x ip(Q) + C 2 ^V(2Q) + C 3 ^V(3Q) = - x 2ip(Q) = ~ c - 

We see again that Sp is independent of the choice of Q. 

Every elliptic curve over ¥ p with an F p -rational point of order 4 is 
isomorphic to a curve of the form 

E 1 : y 2 = x 3 + (1 - 2a)x 2 + a 2 x, P = (a,a) 
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with a G F p , a ^ 0, \ in F p . On this curve, 2P = (0, 0), and so S P = 0. 

4.4. The case m = 5. Write P = (a, 6), 2P = (c, d). By Theorem [3 

Sp = (x^Q) + C x il>{2Q) + C 3 X-<P(3Q) + C ^V(4Q) 

= Xx^q) + Ax 2 </>(q) = Aa + Ac, 

where A = £ + A = C, 2 + C~ 2 ar e the roots of x 2 + x — 1 in F p (v5). 
The value of Sp lies in ¥ p (y/E), and is a root of 

/(x) = x 2 + (a + c)x — a 2 + 3ac — c 2 G F p [x]. 

This value depends on Q, although f(x) does not. 

Every elliptic curve over F p with an F p -rational point of order 5 is 
isomorphic to a curve of the form 

E 1 : y 2 + (1 + a)xy + ay = x 3 + ax 2 , P = (0, 0), 

with a e F p and a (a 2 + 11a— 1)^0. Regardless of the choice of Q, the 
set {a, c} = {0, —a}, and so the possible values of Sp are — Aa, — Aa, 
the roots of x 2 — ax — a 2 . Although Sp does not vanish, note that 
there is always a choice of Q such that Sp = s + ty5, with s + 1 = 0. 

4.5. The case m — 6. We have 

S'p = C^VCQ) + C 2 ^(2Q) + C 3;r V(3Q) + C 4a; V(4Q) + C 5a; V(5<2) 
= (C + C -1 W(Q) + (C 2 + C~ 2 )^2^.(Q) - ^(Q) 

= ^(Q) - ^2V(Q) _ X 3i/)(Q)- 

Note that ip(Q) = ±P, and Sp gives the same result for either value. 
So S'p is independent of Q. 

Every elliptic curve over F p with an F p -rational point of order 6 is 
isomorphic to a curve of the form 

Ei : y 2 + (1 - a)xy - (a + a 2 )y = x 3 - (a + a 2 )x 2 , P = (0, 0), 

with a G Fp, a^O, -1, -§. We find S P = -a(a + 2). 

4.6. The case m = 7. Writing A& = ( k + (~ k , we have 

Sp = XiX^q) + A 2 x^( 2 Q) + A 3 x^( 3 Q), 

which is dependent on the choice of Q. However, analogous to the 
m = 5 case, there is a cubic polynomial / G ¥ p [x] whose roots give 
all possible values for Sp, and whose coefficients are polynomials in 
the x-coordinates of the points in (P). If we let a, b, c denote the 
x-coordinates of P, 2P, 3P, respectively, then 

f(x) = x 3 + {a + b + c)x 2 + {3ab + 3ac + 36c - 2a 2 - 26 2 - 2c 2 )x 

+ (4a6 2 + 46c 2 + 4ca 2 - 3a 2 6 - 36 2 c - 3c 2 a - a 3 - b 3 - c 3 ). 
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Every elliptic curve over F p with an F p -rational point of order 7 is 
isomorphic to a curve of the form 

E x : y 2 + (1 + a - a 2 )xy - a 2 (a - l)y = x 3 - a 2 (a - 1), P = (0, 0), 

where a G F p , a(a — l)(a 3 -8a 2 + 5a + l) ^ 0. In this case, we simplify 
f(x) above and find Sp = a(a — 1)T, where T is a root of 

g {x) = x 3 + (a + l)x 2 - (2a 2 - 3a + 2)x - (a 3 + 3a 2 - 4a + 1), 

with the particular root depending on the choice of Q. 

4.7. The case m = 8. We find 

Sp = —x$(4Q) + v2(aty(Q) - x$(3Q)), 

which is dependent on the choice of Q. Let a, c, d, denote the x- 
coordinates of P, 3P, 4P, respectively. Regardless of the choice of Q, 
Sp is a root of 

f( x ) = x 2 + 2dx + (d 2 - 2 (a - c) 2 ) G ¥ p [x}. 

Every elliptic curve over F p with an F p -rational point of order 8 is 
isomorphic to a curve of the form 

E l :y 2 - (2a 2 - 4a + l)xy - a(3y = x 3 - (3x 2 , P = (0, 0), 

where a G F p , a(a— l)(a— |)(a 2 — «+|) ^ 0, and (3 = (2a—l)(a—l)a 2 . 
We find 

S P = a(l - a) (a 2 ± (2a - 1)^), 
dependent on the choice of Q. 
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